CVE-2026-42975

What it actually does

This vulnerability is a heap-based buffer overflow in the Windows Bluetooth Port Driver. A nearby, unauthenticated attacker can trigger memory corruption over Bluetooth and potentially execute arbitrary code on the affected Windows system. Because the flaw is in a Windows driver, successful exploitation may allow high-privilege code execution, with potential compromise of confidentiality, integrity, and availability. The CVSS vector indicates adjacent-network access, low attack complexity, no privileges required, and user interaction required, meaning exploitation likely depends on the target system engaging in a Bluetooth-related action such as discovery, pairing, or connection handling.

Why it matters to the business

Successful exploitation could allow a physically nearby attacker to take control of affected Windows workstations or servers with Bluetooth capability, leading to data theft, malware deployment, lateral movement, or system disruption. The risk is highest for laptops, mobile workstations, kiosks, conference-room systems, and any Windows servers with Bluetooth adapters enabled. This is not currently listed in CISA KEV, has no known public exploit maturity, and has a low EPSS score, but the impact is still high because exploitation can lead to code execution without prior authentication if an attacker is within Bluetooth range.

How an attack unfolds

An attacker positions themselves within Bluetooth radio range of a vulnerable Windows device. They identify that Bluetooth is enabled and attempt to cause the target to process malicious Bluetooth traffic, likely during discovery, pairing, or connection negotiation that requires some form of user interaction. The malformed Bluetooth input triggers a heap overflow in the Windows Bluetooth Port Driver. If the attacker reliably controls the corrupted memory, they can redirect execution flow and run attacker-controlled code in the context of the vulnerable driver or kernel-adjacent execution path. After code execution, the attacker may install persistence, disable security tools, collect data, or use the compromised endpoint as a foothold for broader intrusion. There is currently no indication from the provided data that this vulnerability is being exploited by named threat actors or ransomware campaigns.

How to fix it

Apply the relevant Microsoft Windows security update or cumulative update that addresses CVE-2026-42975 for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, 2016, 2019, 2022, and 2025. Because exact fixed build numbers were not provided, use Microsoft’s official security update guidance, Windows Update, WSUS, Microsoft Update Catalog, or enterprise patch management tooling to identify the applicable patched build for each supported OS release. Where immediate patching is not possible, reduce exposure by disabling Bluetooth on systems that do not require it, removing or disabling Bluetooth adapters, preventing device discoverability, restricting pairing, and enforcing MDM or Group Policy controls that block unauthorized Bluetooth use. Servers should generally have Bluetooth disabled unless there is a documented operational requirement.

How to confirm the fix worked

Confirm that each affected Windows system has installed the Microsoft security update that supersedes the vulnerable Bluetooth Port Driver. Validate OS build numbers and cumulative update installation status using enterprise patch management, vulnerability scanning, Windows Update history, or PowerShell-based inventory. On representative systems, confirm the installed version and timestamp of bthport.sys under the Windows drivers directory against Microsoft’s patched file metadata. Verify that Bluetooth is disabled or restricted on systems where mitigation rather than patching is used. Re-scan with authenticated vulnerability assessment tooling and confirm the CVE is no longer reported. For exposure validation, inventory systems with active Bluetooth radios, enabled Bluetooth services, discoverable mode, or recent pairing activity.

Typical attack path

1. Attacker moves within Bluetooth range of an affected Windows device.
2. Attacker confirms or infers that Bluetooth is enabled and the device is discoverable, pairing, or otherwise processing Bluetooth traffic.
3. Attacker induces the required user interaction, such as accepting or initiating a Bluetooth-related connection workflow.
4. Attacker sends malformed Bluetooth traffic that reaches the Windows Bluetooth Port Driver.
5. The driver mishandles the input and triggers heap memory corruption.
6. Attacker achieves code execution if exploitation is reliable and memory corruption is controlled.
7. Attacker performs post-exploitation actions such as persistence, credential access, data theft, or lateral movement.

How to detect it

To assess whether this was already exploited, focus on endpoint and Windows telemetry rather than traditional network logs, because exploitation occurs over adjacent Bluetooth radio range. Review Windows System, Application, Security, Kernel-PnP, DriverFrameworks-UserMode/Operational, and Bluetooth-related operational logs for unexpected Bluetooth pairing, connection attempts, device installation, driver resets, or crashes involving the Bluetooth stack. Investigate bugchecks, blue screens, or service instability referencing bthport.sys, bthusb.sys, BTHPORT, Bluetooth drivers, or kernel memory corruption shortly after Bluetooth activity. Correlate suspicious Bluetooth events with EDR alerts for exploit prevention, abnormal child processes, privilege escalation, unsigned driver loading, new services, scheduled tasks, credential access, or tampering with security controls. Because no public exploit or actor-specific tradecraft is indicated, treat Bluetooth-triggered crashes plus immediate post-exploitation behaviors as the strongest available signal. Also review physical-location context where possible, since a successful attacker must be within Bluetooth range.

• bthport.sys
• bthusb.sys
• BTHPORT
• Bluetooth Support Service
• bthserv
• Microsoft-Windows-Kernel-PnP
• Microsoft-Windows-DriverFrameworks-UserMode/Operational
• Microsoft-Windows-Bluetooth
• BugCheck
• DRIVER_IRQL_NOT_LESS_OR_EQUAL
• KMODE_EXCEPTION_NOT_HANDLED
• SYSTEM_SERVICE_EXCEPTION
• PAGE_FAULT_IN_NONPAGED_AREA
• \Windows\System32\drivers\bthport.sys
• \Windows\System32\drivers\bthusb.sys

What your security team should do

• Prioritize patching laptops, mobile workstations, shared workspaces, kiosks, conference-room devices, and any Windows systems where Bluetooth is enabled.
• Patch Windows servers as part of the normal emergency or high-priority security update process, and disable Bluetooth on servers unless explicitly required.
• Use endpoint management tooling to inventory Bluetooth-enabled systems and enforce Bluetooth disablement or pairing restrictions where operationally feasible.
• Review recent Bluetooth pairing and connection activity on high-risk endpoints, especially those used in public or shared physical spaces.
• Create detection logic for unusual Bluetooth driver crashes, unexpected pairing events, and post-exploitation behavior following Bluetooth activity.
• Educate help desk and users not to accept unexpected Bluetooth pairing or connection prompts.
• Track Microsoft advisories for any later exploitability assessment changes, public proof-of-concept release, KEV addition, or revised fixed build guidance.